/* Return true if FILENAME is a non-directory.
Otherwise, including the case in which lstat fails, return false.
*ST is FILENAME's tstatus.
Do not modify errno. */
static inline bool
is_nondir_lstat (int fd_cwd, char const *filename, struct stat *st)
{
int saved_errno = errno;
bool is_non_dir =
(cache_fstatat (fd_cwd, filename, st, AT_SYMLINK_NOFOLLOW) == 0
&& !S_ISDIR (st->st_mode));
errno = saved_errno;
return is_non_dir;
}
/* Return 1 if FILE is an unwritable non-symlink,
0 if it is writable or some other type of file,
-1 and set errno if there is some problem in determining the answer.
Set *BUF to the file status. */
static int
write_protected_non_symlink (int fd_cwd,
char const *file,
struct stat *buf)
{
if (can_write_any_file ())
return 0;
if (cache_fstatat (fd_cwd, file, buf, AT_SYMLINK_NOFOLLOW) != 0)
return -1;
if (S_ISLNK (buf->st_mode))
return 0;
/* Here, we know FILE is not a symbolic link. */
/* In order to be reentrant -- i.e., to avoid changing the working
directory, and at the same time to be able to deal with alternate
access control mechanisms (ACLs, xattr-style attributes) and
arbitrarily deep trees -- we need a function like eaccessat, i.e.,
like Solaris' eaccess, but fd-relative, in the spirit of openat. */
/* In the absence of a native eaccessat function, here are some of
the implementation choices [#4 and #5 were suggested by Paul Eggert]:
1) call openat with O_WRONLY|O_NOCTTY
Disadvantage: may create the file and doesn't work for directory,
may mistakenly report 'unwritable' for EROFS or ACLs even though
perm bits say the file is writable.
2) fake eaccessat (save_cwd, fchdir, call euidaccess, restore_cwd)
Disadvantage: changes working directory (not reentrant) and can't
work if save_cwd fails.
3) if (euidaccess (full_name, W_OK) == 0)
Disadvantage: doesn't work if full_name is too long.
Inefficient for very deep trees (O(Depth^2)).
4) If the full pathname is sufficiently short (say, less than
PATH_MAX or 8192 bytes, whichever is shorter):
use method (3) (i.e., euidaccess (full_name, W_OK));
Otherwise: vfork, fchdir in the child, run euidaccess in the
child, then the child exits with a status that tells the parent
whether euidaccess succeeded.
This avoids the O(N**2) algorithm of method (3), and it also avoids
the failure-due-to-too-long-file-names of method (3), but it's fast
in the normal shallow case. It also avoids the lack-of-reentrancy
and the save_cwd problems.
Disadvantage; it uses a process slot for very-long file names,
and would be very slow for hierarchies with many such files.
5) If the full file name is sufficiently short (say, less than
PATH_MAX or 8192 bytes, whichever is shorter):
use method (3) (i.e., euidaccess (full_name, W_OK));
Otherwise: look just at the file bits. Perhaps issue a warning
the first time this occurs.
This is like (4), except for the "Otherwise" case where it isn't as
"perfect" as (4) but is considerably faster. It conforms to current
POSIX, and is uniformly better than what Solaris and FreeBSD do (they
mess up with long file names). */
{
if (faccessat (fd_cwd, file, W_OK, AT_EACCESS) == 0)
return 0;
return errno == EACCES ? 1 : -1;
}
}
/* Prompt whether to remove FILENAME (ent->, if required via a combination of
the options specified by X and/or file attributes. If the file may
be removed, return RM_OK. If the user declines to remove the file,
return RM_USER_DECLINED. If not ignoring missing files and we
cannot lstat FILENAME, then return RM_ERROR.
IS_DIR is true if ENT designates a directory, false otherwise.
Depending on MODE, ask whether to 'descend into' or to 'remove' the
directory FILENAME. MODE is ignored when FILENAME is not a directory.
Set *IS_EMPTY_P to T_YES if FILENAME is an empty directory, and it is
appropriate to try to remove it with rmdir (e.g. recursive mode).
Don't even try to set *IS_EMPTY_P when MODE == PA_REMOVE_DIR. */
static enum RM_status
prompt (FTS const *fts, FTSENT const *ent, bool is_dir,
struct rm_options const *x, enum Prompt_action mode,
Ternary *is_empty_p)
{
int fd_cwd = fts->fts_cwd_fd;
char const *full_name = ent->fts_path;
char const *filename = ent->fts_accpath;
if (is_empty_p)
*is_empty_p = T_UNKNOWN;
struct stat st;
struct stat *sbuf = &st;
cache_stat_init (sbuf);
int dirent_type = is_dir ? DT_DIR : DT_UNKNOWN;
int write_protected = 0;
bool is_empty = false;
if (is_empty_p)
{
is_empty = is_empty_dir (fd_cwd, filename);
*is_empty_p = is_empty ? T_YES : T_NO;
}
/* When nonzero, this indicates that we failed to remove a child entry,
either because the user declined an interactive prompt, or due to
some other failure, like permissions. */
if (ent->fts_number)
return RM_USER_DECLINED;
if (x->interactive == RMI_NEVER)
return RM_OK;
int wp_errno = 0;
if (!x->ignore_missing_files
&& ((x->interactive == RMI_ALWAYS) || x->stdin_tty)
&& dirent_type != DT_LNK)
{
write_protected = write_protected_non_symlink (fd_cwd, filename, sbuf);
wp_errno = errno;
}
if (write_protected || x->interactive == RMI_ALWAYS)
{
if (0 <= write_protected && dirent_type == DT_UNKNOWN)
{
if (cache_fstatat (fd_cwd, filename, sbuf, AT_SYMLINK_NOFOLLOW) == 0)
{
if (S_ISLNK (sbuf->st_mode))
dirent_type = DT_LNK;
else if (S_ISDIR (sbuf->st_mode))
dirent_type = DT_DIR;
/* Otherwise it doesn't matter, so leave it DT_UNKNOWN. */
}
else
{
/* This happens, e.g., with 'rm '''. */
write_protected = -1;
wp_errno = errno;
}
}
if (0 <= write_protected)
switch (dirent_type)
{
case DT_LNK:
/* Using permissions doesn't make sense for symlinks. */
if (x->interactive != RMI_ALWAYS)
return RM_OK;
break;
case DT_DIR:
/* Unless we're either deleting directories or deleting
recursively, we want to raise an EISDIR error rather than
prompting the user */
if ( ! (x->recursive || (x->remove_empty_directories && is_empty)))
{
write_protected = -1;
wp_errno = EISDIR;
}
break;
}
char const *quoted_name = quote (full_name);
if (write_protected < 0)
{
error (0, wp_errno, _("cannot remove %s"), quoted_name);
return RM_ERROR;
}
/* Issue the prompt. */
if (dirent_type == DT_DIR
&& mode == PA_DESCEND_INTO_DIR
&& !is_empty)
fprintf (stderr,
(write_protected
? _("%s: descend into write-protected directory %s? ")
: _("%s: descend into directory %s? ")),
program_name, quoted_name);
else
{
if (cache_fstatat (fd_cwd, filename, sbuf, AT_SYMLINK_NOFOLLOW) != 0)
{
error (0, errno, _("cannot remove %s"), quoted_name);
return RM_ERROR;
}
fprintf (stderr,
(write_protected
/* TRANSLATORS: You may find it more convenient to
translate "%s: remove %s (write-protected) %s? "
instead. It should avoid grammatical problems
with the output of file_type. */
? _("%s: remove write-protected %s %s? ")
: _("%s: remove %s %s? ")),
program_name, file_type (sbuf), quoted_name);
}
if (!yesno ())
return RM_USER_DECLINED;
}
return RM_OK;
}
